Private Databases

Monitor PostgreSQL, MySQL, Redis and MongoDB — by connecting to them directly, or through the Zharp agent when they aren't reachable from the internet.

All four engines sit behind one entry in the type picker, Database monitor. Its first field, Connection, decides how the database is checked:

Public: Zharp connects directly

1. 1
   Pick the type

   On the Monitors page click New, choose Database monitor under Monitor type, and leave Connection on Public.

2. 2
   Paste a connection string

   Connection string takes the full URI, credentials included. Its scheme decides the engine: postgres:// or postgresql://, mysql:// or mariadb://, mongodb:// or mongodb+srv://, redis:// or rediss://.

   postgresql://monitor:secret@db.example.com:5432/production

   Prefer separate fields? Click Enter details instead and fill in Database type, Host, Database name, Username and Password. Database name is required for PostgreSQL and MySQL; Redis takes a password only. MongoDB also has Auth database, the database the user is defined in — admin when left empty, which is where Atlas and most installations keep their users.

3. 3
   Adjust the connection settings (optional)

   Under Advanced settings → Connection settings:

   Setting	Default	What it does
   Port	The engine's default	5432, 3306, 27017 or 6379 when left empty.
   Health check query	SELECT 1 (PostgreSQL, MySQL), PING (Redis)	Run on every check. A query that errors marks the monitor down.
   Connection timeout	10 seconds	5, 10, 20, 30 or 60 seconds.
   Query timeout	30 seconds	10, 30, 60 or 120 seconds.
   Use SSL/TLS	Required (Preferred for Redis)	See the table below.
   Expected row count	At least 1	Any, At least 1, Exactly 1 or None (empty result). PostgreSQL and MySQL only.

4. 4
   Create it

   Click Create monitor. The first check is due straight away.

SSL/TLS options

The setting means the same for all four engines:

• Redis: a rediss:// connection string always connects over TLS, whatever the dropdown says. With redis:// or Enter details instead, the dropdown decides. A Redis server without TLS needs Preferred or Disabled; with Required the check fails and its message says so. New Redis monitors start on Preferred, and Redis monitors saved earlier with the old Required default were moved to Preferred when Redis began honouring this setting. A user name in the connection string (redis://monitor:secret@host) logs in as that ACL user.
• MongoDB: with Disabled, the connection string decides — mongodb+srv:// URIs connect over TLS, as MongoDB always does for them. When Preferred falls back, half the connection timeout is spent on the encrypted attempt.

Queries for Redis and MongoDB

• Redis: a command as you'd type it in redis-cli, for example INFO replication. Without one, the check is a PING.
• MongoDB: a command document, written as JSON or as db.runCommand({ ... }) / db.adminCommand({ ... }), for example db.adminCommand({ "ping": 1 }).

A public MongoDB check connects with the connection string as you entered it. With Enter details instead, it builds one from the fields: Username and Password are sent and checked against Auth database, and Database name is the database the check reads.

Private: through the Zharp agent

A private monitor reads what the Zharp agent reports. The agent connects to the database locally and sends its numbers to Zharp over HTTPS, so the database never has to accept a connection from outside, and its password never leaves the server.

1. 1
   Install the agent on a server that can reach the database

   Usually the database's own server. At install the agent looks for PostgreSQL, MySQL, Redis and MongoDB. Redis without a password is collected straight away; the others are listed on the host under Integrations → Zharp Agent as Needs setup.

2. 2
   Give the agent a monitoring user

   Open the host and click Set up next to the database. It shows the commands below with a password already filled in — see the monitoring user each engine needs. The database moves to Collecting within a minute.

3. 3
   Create the monitor

   Click New, choose Database monitor, set Connection to Private, and pick the database in Agent connection. Each one is listed by engine and server — for example PostgreSQL on db-01 — with its address added when that isn't localhost. The engine comes from the database you pick.

   A database only appears here once the agent has reported on it. If the list says No connections available, finish the setup on the server first.

• A private monitor has no Connection settings section (port, query, timeouts, SSL, row count): the agent decides how it connects, so the form hides them.
• The agent can watch a database on another machine it can reach: --host and --port for PostgreSQL and MySQL, --endpoint host:port for Redis and MongoDB.

# a database on another machine the agent can reach
sudo zharp-collector add postgres --host 10.0.0.12 --port 5432 --password 'choose-a-password' --db app
sudo zharp-collector add mongo --endpoint 10.0.0.20:27017 --password 'choose-a-password'

Several databases of one engine

One agent can report on any number of PostgreSQL, MySQL, Redis or MongoDB servers. The first of an engine is added as above. Each further one needs --name, made of letters, digits, - or _:

# the first PostgreSQL on this agent needs no name; every further one gets its own
sudo zharp-collector add postgres --name orders --host 10.0.0.12 --password 'choose-a-password' --db orders
sudo zharp-collector add postgres --name billing --host 10.0.0.13 --password 'another-password' --db billing

• Each named database is listed separately — on the host as PostgreSQL (orders), and in Agent connection as PostgreSQL "orders" on db-01 — and gets monitors of its own.
• Running add again without --name keeps the first database's settings and only updates its password; the command reminds you to use --name for another database. Running it again with a name that exists does the same for that database.
• Agents set up before names existed keep reporting their one database per engine, unchanged.

The monitoring user each engine needs

These are the commands the dashboard gives you under Set up. The dashboard fills in a random password made in your browser; Zharp doesn't store it. On Windows, run the zharp-collector line in an elevated PowerShell without sudo.

PostgreSQL

-- as a superuser in psql
CREATE USER zharp_monitor WITH PASSWORD 'choose-a-password';
GRANT pg_monitor TO zharp_monitor;

sudo zharp-collector add postgres --password 'choose-a-password'

MySQL

-- as root in mysql
CREATE USER 'zharp_monitor'@'localhost' IDENTIFIED BY 'choose-a-password';
GRANT PROCESS, REPLICATION CLIENT, SELECT ON *.* TO 'zharp_monitor'@'localhost';
FLUSH PRIVILEGES;

sudo zharp-collector add mysql --password 'choose-a-password'

MongoDB

// as an admin in mongosh
use admin
db.createUser({ user: "zharp_monitor", pwd: "choose-a-password", roles: [{ role: "clusterMonitor", db: "admin" }] })

sudo zharp-collector add mongo --password 'choose-a-password'

Redis

# only when Redis has a password (requirepass); without one the agent collects it by itself
sudo zharp-collector add redis --password '<redis password>'

What a private monitor checks

The agent reports every 30 seconds. On each check, the monitor reads the latest report and compares it with fixed limits — they can't be changed from the dashboard today.

When a private monitor goes down

Before any limit is compared, the monitor checks that the report is there and recent:

A report counts as recent for the monitor's Check frequency plus 30 seconds. With the default of 3 minutes, a database that goes quiet is reported down within about three and a half minutes of its last report.